fix(daytona): quote sync paths before shell mkdir

tests/tools/test_daytona_environment.py

@@ -1,6 +1,8 @@
 """Unit tests for the Daytona cloud sandbox environment backend."""
 
+import shlex
 import threading
+from pathlib import Path
 from types import SimpleNamespace
 from unittest.mock import MagicMock, patch, PropertyMock
 
@@ -321,6 +323,23 @@ def test_daytona_error_triggers_retry(self, make_env, daytona_sdk):
         assert result["returncode"] == 0
 
 
+class TestSyncSafety:
+    def test_upload_if_changed_quotes_parent_path(self, make_env, tmp_path):
+        env = make_env()
+        env._sandbox.process.exec.reset_mock()
+
+        host_file = tmp_path / "token.txt"
+        host_file.write_text("secret", encoding="utf-8")
+        remote_path = "/root/.hermes/skills/evil; touch /tmp/daytona-owned/file.txt"
+
+        uploaded = env._upload_if_changed(str(host_file), remote_path)
+
+        assert uploaded is True
+        expected_parent = str(Path(remote_path).parent)
+        mkdir_cmd = env._sandbox.process.exec.call_args_list[0][0][0]
+        assert mkdir_cmd == f"mkdir -p {shlex.quote(expected_parent)}"
+
+
 # ---------------------------------------------------------------------------
 # Resource conversion
 # ---------------------------------------------------------------------------

tools/environments/daytona.py

@@ -12,6 +12,7 @@
 import threading
 import uuid
 import warnings
+from pathlib import Path
 from typing import Optional
 
 from tools.environments.base import BaseEnvironment
@@ -144,7 +145,7 @@ def _upload_if_changed(self, host_path: str, remote_path: str) -> bool:
             return False
         try:
             parent = str(Path(remote_path).parent)
-            self._sandbox.process.exec(f"mkdir -p {parent}")
+            self._sandbox.process.exec(f"mkdir -p {shlex.quote(parent)}")
             self._sandbox.fs.upload_file(host_path, remote_path)
             self._synced_files[remote_path] = file_key
             return True